vm2 NodeVM require.external Sandbox Escape to RCE (CVE-2026-92946)

// vm2 RCE via require.external — Node.js process spawning host-level child processes indicative of sandbox escape
let suspiciousChildren = dynamic(["cmd.exe","powershell.exe","bash","sh","/bin/sh","/bin/bash","whoami.exe","whoami","curl","wget","nc","ncat"]);
DeviceProcessEvents
| where InitiatingProcessFileName in~ ("node.exe","node")
| where FileName in~ (suspiciousChildren) or ProcessCommandLine has_any ("child_process","require('child_process')","require(\"child_process\")")
| where InitiatingProcessCommandLine has_any ("vm2","NodeVM","require.external")
    or ProcessCommandLine has_any ("vm2","require.external")
| project Timestamp, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, FileName, ProcessCommandLine, AccountName, InitiatingProcessFolderPath
| order by Timestamp desc

index=* sourcetype IN ("linux:syslog","WinEventLog:Microsoft-Windows-Sysmon/Operational","XmlWinEventLog:Microsoft-Windows-Sysmon/Operational") (parent_process_name="node" OR parent_process_name="node.exe" OR ParentImage="*\\node.exe" OR ParentImage="*/node")
| eval child=lower(coalesce(process_name, Image))
| where like(child,"%sh") OR like(child,"%cmd.exe") OR like(child,"%powershell.exe") OR like(child,"%bash") OR like(child,"%whoami%") OR like(child,"%curl%") OR like(child,"%wget%") OR like(child,"%ncat%")
| search (process="*vm2*" OR process="*require.external*" OR parent_process="*vm2*" OR CommandLine="*child_process*")
| stats count min(_time) as firstTime max(_time) as lastTime values(child) as spawned_children values(process) as cmdlines by host, parent_process_name, user
| convert ctime(firstTime) ctime(lastTime)
| sort - count

process where process.parent.name in ("node", "node.exe") and
  (
    process.name in ("sh", "bash", "cmd.exe", "powershell.exe", "whoami", "whoami.exe", "curl", "wget", "ncat", "nc") or
    process.command_line like~ "*child_process*"
  ) and
  (process.parent.command_line like~ "*vm2*" or process.parent.command_line like~ "*require.external*" or process.command_line like~ "*require.external*")

SELECT QIDNAME(qid) AS event, "Process Name" AS process, "Parent Process Name" AS parentProcess, "Process CommandLine" AS commandLine, username, sourceip, devicetime
FROM events
WHERE ("Parent Process Name" ILIKE '%node.exe' OR "Parent Process Name" ILIKE '%node')
AND (
  "Process Name" ILIKE '%cmd.exe' OR "Process Name" ILIKE '%powershell.exe' OR "Process Name" ILIKE '%/sh' OR "Process Name" ILIKE '%/bash'
  OR "Process CommandLine" ILIKE '%child_process%'
)
AND ("Process CommandLine" ILIKE '%vm2%' OR "Process CommandLine" ILIKE '%require.external%')
ORDER BY devicetime DESC LAST 7 DAYS

_sourceCategory=*os* OR _sourceCategory=*sysmon*
| where (parentProcessName matches "*node.exe" or parentProcessName matches "*node")
| where (processName matches "*cmd.exe" or processName matches "*powershell.exe" or processName matches "*/sh" or processName matches "*/bash" or commandLine matches "*child_process*")
| where (commandLine matches "*vm2*" or commandLine matches "*require.external*" or parentCommandLine matches "*vm2*")
| count by host, user, parentProcessName, processName, commandLine
| sort by _count

rule vm2_require_external_rce_cve_2026_92946 {
  meta:
    author = "Argus"
    description = "vm2 NodeVM require.external sandbox escape to RCE (CVE-2026-92946)"
    severity = "CRITICAL"
  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    re.regex($e.principal.process.parent_process.file.full_path, `(?i)node(\.exe)?$`)
    (
      re.regex($e.target.process.file.full_path, `(?i)(cmd\.exe|powershell\.exe|/sh|/bash|whoami|curl|wget|ncat)$`) or
      re.regex($e.target.process.command_line, `(?i)child_process`)
    )
    (
      re.regex($e.target.process.command_line, `(?i)(vm2|require\.external)`) or
      re.regex($e.principal.process.command_line, `(?i)(vm2|require\.external)`)
    )
    $host = $e.principal.hostname
  match:
    $host over 5m
  condition:
    $e
}

#event_simpleName=ProcessRollup2
| ParentBaseFileName=/node(\.exe)?$/i
| (ImageFileName=/\\(cmd\.exe|powershell\.exe)$/i or ImageFileName=/\/(sh|bash|whoami|curl|wget|ncat)$/i or CommandLine=/child_process/i)
| (CommandLine=/vm2|require\.external/i or ParentCommandLine=/vm2|require\.external/i)
| table([@timestamp, ComputerName, UserName, ParentBaseFileName, ParentCommandLine, ImageFileName, CommandLine])